Skip to content

Cookie preferences

We use cookies for our own analytics, to see how our campaigns perform and, if you allow it, to load content from other services such as the Google site search. We never sell your data. Necessary cookies keep the site working and cannot be switched off. See our Cookie Policy for details and our Privacy Policy for how we handle personal data.

Security, load balancing and remembering your cookie choice.

Show us which pages people read, how they find the site and where they get stuck, so we can improve it (Google Analytics, Microsoft Clarity).

Show us which of our ad campaigns bring visitors to the site and remember the campaign or partner link you arrived from (Google Ads, LinkedIn, Meta, partner program). We do not use these cookies to build advertising profiles.

Load the site search from Google when you use it. Google sets its own cookies and shows ads in the search results.
© 2026 The ThingsBoard Authors
22.5k Try for free

ThingsBoard Cloud

Choose your data region

Your data stays in the region you choose, for residency and compliance. No credit card required.

North America Data stored in North America Europe Data stored in the European Union

Rather run it yourself? Install on your own servers

Trust Center

Report a vulnerability

Found a security issue in a ThingsBoard product or service? Tell us privately, so we can fix it before anyone can exploit it. Copy our template into your own email, fill it in and send it to us.

What happens next

  1. We reply within three business days with a plan to investigate.
  2. We keep you updated until the fix is released.
  3. Fixed CVE IDs are listed in the release notes.

Before you test

  • Use your own installation or your own Cloud account.
  • Don't access, change or delete other people's data.
  • Don't run denial-of-service or load tests against ThingsBoard Cloud.
  • Keep the details private until the fix is out.

  1. Start an email to our security team

    To
    security@thingsboard.io
    Subject
    Vulnerability report: <short summary>

  2. Paste the template and fill it in

    The first four lines are what we need; the rest only if you know.

    Product and version: <for example ThingsBoard Cloud, or ThingsBoard 4.4.0 self-hosted>
Vulnerability type: <for example access control, injection, XSS, or other>
What an attacker can do: <and what access they need first: none, a customer user, a tenant administrator or device credentials>
Steps to reproduce:
1.
2.
3.

Where, if you know: <the URL, API endpoint or component>
Severity, in your view: <critical, high, medium, low or not sure; a CVSS vector if you have one>
Already public or seen exploited? <no, or yes and where>
Planning to publish? <the date, if so>
Credit: <your name or handle, or anonymous>

  3. Attach your evidence and send

    Screenshots, proof-of-concept code or HTTP captures. Leave out other people's data and any live credentials.